AI Agent
Core Facts
The Principle of Least Privilege holds that any principal should only be granted the minimum permissions necessary to complete its task.
Mainstream Agent architectures typically use a large language model as the brain, combined with memory modules, planning modules, and tool interfaces to accomplish complex tasks
AI development has evolved through four stages: single large model calls, prompt engineering, agents and tool calls, and loop engineering.
Timeline (last 90 days)
AI Agent security failures can be summarized into four paths: correct by design but insufficient in coverage, measuring the wrong thing, not knowing the Agent exists, and human factors.
Credentials are the only element that is independent of context; they either allow access or they do not, and when an Agent goes wrong, credentials ultimately determine how far the damage can spread.
Agent risk = probability of failure × Agent reach; control measures reduce the probability of failure, and access control limits the reach, and neither can be dispensed with.
After an Agent is deleted, the OAuth grants it used often still remain alive, because the provisioning process bypasses the identity provider, creating orphan credentials.
Service accounts are machine accounts for non-human identities, typically granted long-lived keys for service-to-service calls, and they are often over-privileged, difficult to rotate, and not bound to a specific person; once obtained by an Agent, they become a ghost identity with no MFA, no behavioral baseline, and the ability to lurk long-term.
There is currently no widely accepted end-to-end standard for Agent delegation chains, so the original operator identity is easily lost at every hop, and downstream systems see only a broad service identity.
Not knowing the Agent exists is the most common AI Agent security failure path, manifesting as failing to see that an Agent holds credentials it should not hold (such as service accounts, unapproved built-in tool permissions, or overly broad OAuth grants).
The industry is exploring On-Behalf-Of tokens that convey user identity, verifiable credentials (VC), and identity frameworks specifically for Agents to solve the problem of the missing standard for Agent delegation chains.
In an environment where the number of AI agents is surging, humans' immunity to "agent sales pitches" is increasing, while attention to "agent honesty" remains scarce.
App walls (such as "open in the app" or "continue after logging in") constitute a substantial obstacle to AI Agents' external reach, and providing a pure readable HTML page that requires no login is more effective than deep links.
40 more timeline events
All Facts (20)
The Principle of Least Privilege holds that any principal should only be granted the minimum permissions necessary to complete its task.
90%VerifiedMainstream Agent architectures typically use a large language model as the brain, combined with memory modules, planning modules, and tool interfaces to accomplish complex tasks
90%VerifiedAI development has evolved through four stages: single large model calls, prompt engineering, agents and tool calls, and loop engineering.
90%VerifiedThe stronger a model's capabilities and the more external tools it can invoke, the broader its potential attack surface—this is a fundamental dilemma facing AI vendors.
90%VerifiedAgents possess capabilities for planning, tool invocation, memory, and autonomous iteration, distinguishing them from the single-round question-and-answer mode of traditional large language models.
90%VerifiedA Skill is a modular encapsulation that packages specialized capabilities, domain knowledge, and operational norms into reusable units, enabling Agents to invoke them automatically at the appropriate moment.
90%VerifiedAI model performance is positively correlated with the amount of data fed to it, and enterprises must continuously input business details to obtain more accurate AI outputs
90%VerifiedThe intelligent proxy layer can fully record every operation initiated by the AI (HTTP calls, command executions, resource accesses), forming a traceable audit log.
90%VerifiedA poorly designed AI agent may fall into a closed loop of goal → call API → failure → retry → loop, continuously consuming resources and accumulating costs without human monitoring.
90%VerifiedIn scenarios involving factual accuracy, logical rigor, and high-stakes decision-making, AI should be positioned as a tool rather than an autonomous agent to which decisions can be fully delegated, and human oversight and verification are indispensable.
90%VerifiedAI Agent errors have semantic plausibility—each step appears reasonable but in combination drifts from the original goal—making post-hoc log-based troubleshooting more complex than with traditional systems.
90%VerifiedA complex Agent task may require dozens or even hundreds of model calls
90%VerifiedPrompt注入（Prompt Injection）是针对大语言模型应用的安全威胁，攻击者通过在输入中嵌入恶意指令试图覆盖系统原有行为约束
90%VerifiedAI编程工具正在经历从被动辅助（代码补全）到主动执行（自主智能体）的范式转变
90%VerifiedThe EU Artificial Intelligence Act (AI Act) explicitly requires that high-risk AI systems must have human oversight and intervention capabilities.
90%VerifiedThe architecture of an AI Agent typically consists of four modules: a perception module, a memory module, a planning module, and an action module.
90%VerifiedCurrently mainstream AI Agent frameworks include LangChain, AutoGen, CrewAI, and others.
90%VerifiedAI Agent通过工具调用（Tool Use）机制与外部系统交互，包括执行代码、调用API、读写数据库等
90%VerifiedAgent planning capabilities are typically implemented through the ReAct (Reasoning + Acting) framework.
90%VerifiedReading less output does not equal spending less money; the true cost of AI agents is hidden in context caching, extra rounds, and the blowback caused by task quality fluctuations—none of which can be compressed by a compression tool.
85%